EIP-2026-109420

The exploit demonstrates a sandbox security bypass in MentalJS via a crafted URL that injects malicious JavaScript. The payload manipulates the DOM to execute arbitrary code (e.g., `alert(0)`) by leveraging an XSS vulnerability in the `innerHTML` assignment.